ICANN may not reveal its list of new generic top-level domain applications until as late as the last week of June, according to CEO Rod Beckstrom.

In his first interview since ICANN took its TLD Application System offline due to a security bug, Beckstrom told DI that he “hopes” to host the Big Reveal before he steps down as ICANN’s CEO.

He said he expects to have the new gTLD program back on track before he hands the reins to the organization over to his successor at the end of the ICANN 44 meeting in Prague, June 29:

I’d like to see us obviously get the technical issues resolved, notify applicants, reopen the window and publish the strings before I pass the baton in Prague. That’s not a commitment at this point in time, it’s an indication as CEO that it’s absolutely my intention to push for a timely resolution of this issue… If we can get things done sooner, then the sooner the better.

The Big Reveal was originally scheduled for today. However, the TAS delays made this impossible. Following an ICANN update on Friday, a late-May date for the Big Reveal was looking more probable.

But Beckstrom would not commit even to the Prague date. He said:

That’s my hope as a CEO, to get these issues resolved by that time-frame and have the string reveal in that time-frame. I haven’t committed the organization, I’m indicating to you volitionally my desire as CEO and the person who’s running the organization.

He framed the issue as a blip on a nine-year process (six years of policy development, one year of outreach and application filing, and up to two years of evaluation). He said:

In the context of nine-year program, a delay of between here and Prague of a few months is undesirable, it’s not what we want to have happen, but the quality of this program is more important to everyone involved than the specific date and time. We’re all focused on quality here and not just doing things in a hurry. This program is too important.

He said he is “sympathetic” to applicants that are burning through start-up funding waiting for ICANN to sort this out, but he noted that the same concerns have been raised over the years whenever the program has previously missed a launch deadline.

We know that some parties have been very patient and we know it’s got to be frustrating right now to see any delay in the program. At the same time, I’m sure that those parties are very concerned that this be done well and that the program be reopened and administered successfully.

Beckstrom reaffirmed ICANN’s promise to notify all applicants whether or not they were affected by the TAS bug – which revealed user names and file names to other TAS users – by May 8.

But TAS will not, it seems, reopen immediately after the notifications have been sent. As well as the log audit, ICANN is also working on performance upgrades.

While Beckstrom confirmed that the plan is to open TAS for five business days, to give applicants a chance to finish uploading their applications and confirm that their data has not been corrupted, he would not say when this window is due to open.

We’re going to share more precise dates when we have them. What I can tell you precisely right now is that the key thing we’re working on is combing through this large data set we have so that the parties that were affected are notified within the seven days. When we have clarity on the next milestone in the process we’ll communicate that openly.

…

We’re still doing system testing, we’re still looking at some of the performance issues. We have a whole set of things to do and feel comfortable that we’re ready and have full internal sign off. We’ll notify you and other parties when we have that clarity. Right now we have the clarity that we’re going to get the notification done in seven days – that’s the key dating item at this time.

…

We have very strong reason to believe we understand the bug and we’ve fixed the bug, but every day that we continue to test we gain a higher level of confidence in the system that this specific issue will not reappear.

While the first report of the bug was received March 19, it was not until April 12 that ICANN managed to “connect the dots” and figure out that the problem was serious and recurring, Beckstrom said.

ICANN saw the bug show up again repeatedly on April 12, as many TAS users logged in to finish off their applications, which was why it chose to take the system down with just 12 hours to go before the filing deadline.

ICANN is currently analyzing a 500GB log containing a record of every data packet that went into and out of the TAS between January 12 and April 12, to reconstruct every user session and determine who could see what and when, Beckstrom said.

He refused to comment on whether this analysis has revealed any attempts by TAS users to deliberately exploit the bug for competitive intelligence on other applicants.

He also declined to comment on whether ICANN has discovered instances of data leakage between two applicants for the same gTLD string.

The full packet capture system was introduced following a third-party security audit of the system conducted late last year, he said.

That audit, of course, did not reveal the data leakage vulnerability that continues to delayed the program.

When I put it to him that this is precisely the kind of problem ICANN wanted to avoid, due to the confidentiality of the applications, Beckstrom played down the seriousness of the bug.

Let’s be clear here: some user names and file names were visible, not the contents of applications and not the contents of those files. I think that if that had occurred it would be an even more undesirable situation and we have no indication that that occurred.

I wouldn’t call this a security issue, I’d call this… every major software system we use has bugs in it or bugs that are discovered over time. Whether that’s our operating systems or desktop applications or specific applications, you conduct the best tests you can. You assemble a testing suite, you assemble testers, you take various methods, but there’s never a guarantee that software is bug-free. The issue is that if and when bugs are encountered you deal with them appropriately, and that’s what we’re doing right now.

But Beckstrom admitted that the problem is embarrassing for ICANN, adding that sorting out the mess is currently the top priority.

Obviously any time you have a software problem or technical problem with any program you come under enhanced scrutiny and criticism, and I think that’s understandable, that’s fair. What we’re focused on is resolving this successfully and I think ICANN has dealt with many challenges in its past successfully and we’re committed to resolve this issue professionally.

…

I should tell you that this is our top priority right now internally right now. The resolution of this issue is our number one priority, the number one issue for me as CEO, number one for most members of the executive management team and for a large part of the organization. We’re extremely focused on this.

ICANN plans to reveal how many applicants were affected by the bug at the same time as it notifies applicants, Beckstrom said. It will not publish information about who could see what, he said.

Unfortunately for applicants, it seems they will have to wait well into next week before they have any more clarity on the timetable for TAS coming back online and the application window finally closing.

With Prague now emerged as a potential deadline for the reveal, the delays could in fact be much worse than anyone was expecting.

One hundred companies have registered to apply for generic top-level domains, according to ICANN senior vice president Kurt Pritz.

ICANN has decided not to provide a running commentary about how many applications have been received, but it did say that 25 companies registered in the first week the program was open.

“That number is now up to 100,” Pritz said today at the The Top Level conference in London.

He was referring to companies paying their $5,000 to sign up for ICANN’s TLD Application System, which is likely to be much smaller than the actual number of gTLD applications. Each TAS account can store up to 50 applications, Pritz said.

There are only 45 days left on the clock to register for a TAS account. After March 29, you’re in for a wait of at least three years (my estimate) before the opportunity comes around again.

Pritz’s revelation was one of the more interesting things to emerge during today’s half-day gathering at the offices of the PR firm Burson-Marsteller, which attracted about 40 attendees.

The other big surprise was that Scandinavian Airlines System Group, the dot-brand applicant that was due to give a presentation on its plans for .sas, was a no-show.

I gather that somebody more senior at SAS found out about the conference and decided that revealing all was not such a great business strategy after all.

Most dot-brand applicants are playing their hands close to their chest, even if they’re not heading into a contested gTLD scenario (which SAS may well be if the software firm SAS Institute also applies for .sas).

I also found it notable that there’s still substantial confusion about the program among some potential dot-brand applicants, several of which did show up as general attendees.

I talked to one poor soul who had read the latest revision of the 349-page Applicant Guidebook back-to-back after it was published January 11, trying to figure out what had changed.

These are the types of applicant – people unfamiliar not only with ICANN’s processes but also even with its web site – that are being asked to hack the Guidebook to make the rules compatible with a dot-brand business model, remember.

One potential applicant used a Q&A session during the conference to bemoan the fact that ICANN seems intent to continue to move the goal-posts, even as it solicits applications (and fees).

Pritz and Olof Nordling, manager of ICANN’s Brussels office, reiterated briefly during their presentation today that the current public comment period on “defensive” applications could lead to changes to the program’s trademark protection mechanisms.

But this comment period ends March 20, just nine days before the TAS registration deadline. That’s simply not enough time for ICANN to do anything concrete to deter defensive applications.

If any big changes are coming down the pipe, ICANN is going to need to extend the application window. Material changes made after the applications are already in are going to cause a world of hurt.